Evidence Export & Timestamping Flashcards
7 cards from real CST practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Evidence Export & Timestamping flashcards as text
When exporting video evidence for court, which file attribute is most critical to preserve to demonstrate the footage has not been altered?
Answer: Cryptographic hash value (MD5/SHA)
A cryptographic hash value (MD5 or SHA) provides a verifiable fingerprint proving the exported file is bit-for-bit identical to the original.
A DVR's internal clock drifts 4 minutes fast over a month. When exporting footage for an incident that occurred at 2:15 PM, what timestamp should be noted in the chain of custody?
Answer: 2:11 PM after subtracting the clock drift
The corrected time (2:11 PM) should be documented alongside the displayed DVR time, with the clock discrepancy noted in the chain of custody.
Which export method best preserves original video evidence integrity compared to screen-capture recording?
Answer: Native format export directly from the DVR/NVR
Native format export preserves the original encoded data without recompression or quality loss, maintaining evidentiary integrity.
An investigator needs to verify the NVR system clock is accurate before exporting evidence. What is the most reliable reference source for time verification?
Answer: An NTP-synchronized server or GPS time source
NTP-synchronized or GPS time sources provide authoritative, traceable time references accepted as accurate in legal proceedings.
What document must accompany exported video evidence to maintain admissibility throughout its custody lifecycle?
Answer: A chain of custody form signed by each person who handled the evidence
A chain of custody form documents every transfer and handling of evidence, establishing an unbroken record required for court admissibility.
Which storage media is generally preferred for long-term archival of exported surveillance video evidence?
Answer: Write-once optical media (DVD-R, BD-R) or WORM drives
Write-once media physically prevents overwriting, providing tamper-evident storage that strengthens the case for unaltered evidence.
When documenting a clock discrepancy during evidence export, which details must be recorded?
Answer: Both the DVR-displayed time and the verified real-world time, plus how discrepancy was measured
Full documentation requires recording both times and the measurement method so investigators and courts can reconstruct the true event timeline.